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Introduction 


The Reactor-In-Flight -Test (RIFT) Project was initiated in June 1962 to develop 
a nuclear stage and vehicle capable of performing advanced missions in space. The 
RIFT flight test program consists of a series of ballistic flight tests at the 
Merritt Island Launch Area - Atlantic Missile Range (MILA-AMR) to demonstrate this 
capability. 

The Marshall Space Flight Center is charged with the design, development, 
fabrication, system integration, and static tests of the RIFT vehicle. The Launch 
Operations Center will conduct launch operations at MILA. The Lockheed Missiles and 
Space Company was selected as the prime contractor for RIFT stage design, develop- 
ment, etc. NERVA engine development is the responsibility of the Space Nuclear 
Propulsion Office (SNPO) , and Aeroject-General Corporation has the contract for the 
engine development with a subcontract to Westinghouse for reactor development. 

The RIFT development and test program involves not only about all the compli- 
cations of a large chemical stage development but also the problems arising from 
the potential hazards of a nuclear reactor capable of producing very high power 
levels. Safety, therefore, must be an important and integral part of the program 
from conception through design, development, and test. 


The RIFT vehicle configuration. Figure 26, consists of the S-1C stage, S-ll 
stage, S-N stage, instrument unit, and nose cone. The RIFT stage is 33 feet in 
diameter, and 80 feet long; the total SATURN V/RIFT vehicle length is over 350 feet. 

The S-1C booster now being developed for the SATURN V launch vehicle is approxi- 
mately 140 feet long, uses five Rocketdyne F-l engines producing a total of 7.5 mil- 
lion pounds thrust, and has a propellant capacity of approximately 4.5 million pounds 
of LOX and RP-1. 

The S-ll stage will be included as a dummy in the RIFT flight test to provide 
structural and dynamic simulation. The S-ll is approximately 80 feet long and will 
be ballasted for propellant -weight simulation on the RIFT flights. For operational 
missions, the S-ll stage would be powered by five Rocketdyne J-2 engines producing 
a total thrust of approximately 1 million pounds and would have a total propellant 
capacity of approximately 900,000 pounds of LOX and LH 2 . 

The RIFT S-N stage is approximately 80 feet long and consists of a propellant 
tank, nuclear engine, and interstage. Liquid hydrogen contained in the welded alumi- 
num tank will be forced through the reactor by a combination of tank pressure and 
engine turbopump action, absorbing heat from the reactor before passing into the 
thrust chamber as hot hydrogen gas. The RIFT stage propellant capacity is approxi- 
mately 100,000 pounds, but for operational missions the tank size may vary between 
100,000 and 200, 0C^ pounds depending upon the specific mission. 


RIFT Stage and Vehicle Description 
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Figure 26. SATURN V/RIFT vehicle 


The Instrument Unit (IU) containing the guidance and controls for the vehicle 
is 3 feet long and is mounted between the S-N stage and the nose cone which projects 
above the IU to a length of 50 to 60 feet along a half angle of 15 degrees. 


S-N Stage Safety Systems 


The S-N stage safety systems, in addition to the SATURN V vehicle safety sys- 
tems, are designed to reduce to a minimum the potential hazard associated with the 
flight of a nuclear-powered rocket. To provide maximum safety and reliability for 
the reactor-in-flight tests, the flight system must be capable of responding to all 
foreseeable malfunctions and of achieving an acceptable termination of the flight 
program at any point within the defined flight span. 

Major S-N stage safety systems are as follows: 

Criticality monitoring system 
Propellant prevalve 

Stage -Engine operational sequence safety system 

Stage GN 2 purge system 

Engine purge system 

Engine safety system 

Stage destruct system 
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A radiation monitoring system with detectors at strategic locations throughout 
the stage will provide information on neutron count and gamma radiation on a continu- 
ous basis. Alarm circuits will be triggered if preset levels are exceeded. 

An isolation valve, referred to as the propellant "prevalve , M will be located 
at the propellant tank outlet to prevent leakage of liquid hydrogen into the reactor 
system before scheduled thrust buildup. This valve consists of a stainless-steel 
disc surrounded by an annular ring of shearable metal alloy which provides a hermetic 
seal to the tank outlet line. 

In-flight initiation of the S-N stage operations requires that specific func- 
tions be accomplished in sequence with appropriate safety interlocks to ensure the 
safe startup, operation, and shutdown of the react or /engine system. This function 
is performed by the stage-engine operational sequence safety system. 

An inert -gas purge system will be used to reduce or eliminate undesirable gases 
such as oxygen from the propellant tank, interstage and forward equipment areas, and 
engine system. Reducing oxygen to less than 1 percent by volume in the inert gas 
will eliminate the oxygen/hydrogen explosive hazard. 

Several engine safety systems are being considered. An anticriticality poison 
system would incorporate poison wires in the reactor to prevent reactivity buildup 
in case of inadvertent control-drum operation or immersion of the reactor in water. 

An anticriticality destruct system in combination with the stage destruct system 
would destroy the reactor in case of in-flight malfunction after booster separation 
and before engine power increase from 1-percent power hold to 100-percent power. A 
post operational destruct system would fragment a radioactive engine and reduce the 
core to particles fine enough to reduce radiation to an acceptable level. 

The stage destruct system will initiate engine shutdown and propellant tank 
destruction upon receipt of a properly coded RF signal. High reliability is achieved 
through use of two independent redundant circuits powered from separate electrical 
power buses. A common antenna system and common ordnance components are used because 
of their inherent reliability. 


Pre launch Testing 


Nuclear rocket flight test stages, unlike chemical stages, will not have been 
test fired before flight because of the fission-product buildup and the induced 
radioactivity that such testing would produce. It is therefore mandatory that the 
development test program for RIFT include extensive prelaunch testing, effective 
quality assurance procedures, and as much simulation of flight conditions as 
practicable . 

The RIFT program includes tests at the Propellant Tank Facility and the Cold 
Flow Facility and captive testing at the Nuclear Rocket Development Station (NRDS) • 
Twenty to thirty test firings, simulating in-flight conditions, and functional se- 
quences are to be conducted at NRDS before the first RIFT flight. 


Preflight Operations 


The safety record of chemical rocket operations involving large quantities of 
explosive and toxic materials at the Atlantic Missile Range has been outstanding. 
This record has been achieved through careful planning, thorough training, and ade- 
quate facilities and equipment. 


The introduction of a nuclear -powered stage requires a new and complete exami- 
nation of the elements which have contributed to the safety of chemical rocket 
operations plus additional study of the problems peculiar to the nuclear system. 
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The Merritt Island Launch Area and the Atlantic Missile Range are well suited 
for nuclear launch operations with ample space for facilities and required exclusion 
areas. MILA and Launch Complex No. 39 (LC-39) from which the SATURN V, and there- 
fore RIFT, will be launched, are shown in Figures 27 and 28. Three launch pads are 
located along the ocean 8730 feet apart. This distance is sufficient to prevent 
damage to a vehicle in the event of an explosion of another vehicle on an adjacent 
pad during simultaneous checkout operations. The Vertical Assembly Building (VAB) 
in which the chemical stages will be checked out and erected is located approximately 
3-1/2 miles west of the southernmost launch pad. A Nuclear Assembly Building (NAB) 
will be located approximately 1/2 mile north of the VAB. 

The closest public habitation to the LC-39 pads is along Highway US 1, and at 
Titusville, 10 to 11 miles away. Access to the VAB will be by barge, railroad, or 
highway . 

The AMR extends from Cape Canaveral, Florida, into the Indian Ocean beyond 
South Africa and includes island tracking stations, instrumented ships and aircraft, 
and all necessary equipment for data acquisition and reduction incident to long- 
range missile and space vehicle operations. 

A brief examination of the pre launch operation which the SATURN V/RIFT vehicle 
will probably go through at MILA will furnish the basis for more detailed consider- 
ation of potential hazards. The SATURN V stages and RIFT will be shipped to MILA by 
ocean-going vessels. Arriving at the canal terminus near the VAB, the S-1C and S-ll 
will be rolled off on their transporters and towed to the VAB, Figure 29. There, 
the S-1C will be erected on the Launcher Umbilical Tower (LUT) and the S-ll will be 
taken to the low-bay area of the VAB for checkout. The RIFT stage will be towed on 
its transporter to the NAB for checkout and mating with the engine. 

The reactor, engine, and RIFT stage will each be subjected to detailed in- 
spections for shipping and handling damage, followed by functional checkout as re- 
quired. The reactor will be mated to the engine and the subsequent checkout will 
probably include a criticality test to verify control-drum calibration and core 
reactivity. Following this test, the integrated NERVA engine/RIFT stage will be 
checked out and prepared for transportation to the VAB. 

At the VAB high bay, the S-ll will have been erected on the booster and final 
mating of the RIFT stage and the Instrument Unit (IU) will take place. After the 
mechanical mating and alignment of the stages and IU, the stages are mated to the 
LUT Ground Support Equipment (GSE) and limited-stage/GSE checks performed before 
electrically mating the stages with each other. Following the completion of the 
stage-GSE compatibility tests, the stages will be electrically mated and the launch- 
vehicle systems test performed. 

When the complete vehicle is in a ready condition, the crawler-transporter , 
Figure 30, is moved into position under the LUT. Hydraulic jacks will lift the LUT 
and vehicle and move out the crawlerway to the launch pad where the LUT will be 
positioned onto prepared pedestals. The crawler will then move the arming tower. 
Figure 31, into position at the launch pad for ordnance installation and final 
servicing. Figure 32. 

At the pad, the LUT and space vehicle services such as digital data link com- 
munications circuitry, pneumatic and propellant lines, environmental controls, and 
power supply lines will be connected, the vehicle aligned, and ordnance installed. 

The launch-pad program will consist of the following: 

Limited subsystem verification check from the Launch Control Center (ICC) 

Checkout of hardwire backup circuits to ICC 

Tank pressurization test 

Propellant loading test 

RF systems test 

Simulated flight test 
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Figure 27. Merritt Island launch area 
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Figure 28. Launch Complex 39 
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Figure 29. Vertical assembly building 
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Figure 30. Crawler-transporter 
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Following a successful simulated flight test, the vehicle is ready to enter 
the 10-hour countdown preparatory to launch. 


Flight Operations 


A typical trajectory for the RIFT mission is shown in Figures 33 and 34. The 
NERVA engine will operate through programmed cycles and cool down before final im- 
pact in the deep ocean area beyond the Blake escarpment. 
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Figure 33. RIFT trajectory - Lob 
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Figure 34. RIFT trajectory - Ballistic 
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Safety Considerations 


Before attempting to identify steps in the SATURN V/RIFT operation which 
could lead to a nuclear hazard, it is necessary to consider the conditions under 
which a nuclear excursion is credible. Several such conditions are readily 
identifiable : 

Control-drum runout 

Hydrogen filling of reactor 

Core compaction from impact or explosion 

Water immersion 

Immersion in RP-1 


With the above conditions in mind, a step-by-step examination of the proposed 
SATURN V/RIFT operation at LC-39 will readily identify potentially hazardous condi- 
tions. Such a qualitative procedure, although necessary, can be misleading since 
the probability of occurrence of some of these so-called '‘credible accidents" may be 
so low as to make their consideration unrealistic. It will therefore be necessary 
to subject this sequence of operations to a quantitative analysis before judging the 
safety of the operation. 

The reactor for the NERVA engine will arrive at MILA with full shipping poisons 
in place and can probably remain in this condition until it is mated with the en- 
gine. The type of poison system to be employed throughout the operation at MILA is 
a problem that is under active consideration at this time and will not be discussed 
in this paper although the final poison system selection will have a major effect 
on safety problems. During all ground checkout operations except reactor critical- 
ity and related tests, the reactor will contain at least enough poison to prevent 
inadvertent control-drum operation from causing a nuclear incident. The ultimate 
goal is to include sufficient poison to prevent the reactor from becoming critical 
under any conceivable circumstances. 


NAB Operations 

A review of the safety of operations as proposed within the NAB shows that 
only two of the accidents described previously merit any further consideration since 
no explosive propellants or liquid hydrogen will be present in the NAB. Consider- 
ation is therefore limited to control-drum runout and reactor deformation because of 
ground impact. Control drums will be locked and the core at least partially poisoned 
during the react or /engine mating operation and during transit within the NAB. Thus, 
from a handling standpoint, the worst conceivable accident would be a drop of the 
partially poisoned core from a height of, at most, 20 feet during the initial oper- 
ation of picking up the core for mating with the nonnuclear engine assembly. Pre- 
liminary analysis indicates that the dropping of a partially poisoned core from 
20 feet will not result in a nuclear incident. Drop-test experiments will be con- 
ducted on scale reactor models to provide data from which core deformation calcula- 
tions can be made. 

Control-drum override poisons and drum locks must, of course, be removed dur- 
ing the performance of criticality checks and control-drum calibration in the 
reactor/engine checkout area. Thus, the safety of the system is degraded to its 
lowest level at this point in the operation. Criticality tests will be remotely 
performed in a controlled area from a shielded control room which would protect test 
personnel from direct radiation and fission-product dispersal in the event of a nu- 
clear incident. The probability of a nuclear incident is quite remote since a large 
number of similar operations will have been performed, the particular core under 
test will have undergone a similar test before shipment, and a complete transit his- 
tory will be available to give any indication of abnormal conditions or potential 
difficulties. Even so, the possibility of a control-drum runout at this point can- 
not be ruled out completely. 
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The NAB will have a detailed personnel rad-safe protection program, an enclosed- 
area monitoring system, emergency protection equipment, and possibly a continuous 
engine/reactor monitoring system. All areas associated with reactor, reactor/engine, 
and engine/stage mating operations will be controlled, with limited access only to 
authorized personnel. These areas will be equipped with extensive detection equip- 
ment monitoring each area at several locations for air contamination, gamma rays, 
and neutrons. These systems will be coupled with an audible alarm system preset to 
actuate at a given radiation level. These fixed monitoring systems will be augmented 
by portable detection systems in critical areas such as the reactor and reactor/ 
engine assembly areas. 


Transport NAB to VAB 

The VAB is approximately 3000 feet from the NAB. Since transfer time may be 
scheduled to avoid unfavorable weather conditions, an accident does not appear credi- 
ble that could result in a nuclear incident during this operation. Core poison is 
installed, drums are mechanically locked, and since there is no water along the route, 
water immersion is not credible. 


Operation in the VAB 

Before arrival of the RIFT stage, the S-ll stage will have been checked out 
and erected on the S-1C. The RIFT stage on its transporter will be positioned under 
the 250-ton crane in the high bay, removed from the transporter for mating to the 
interstage, and then hoisted into position on the S-ll stage. 

Inasmuch as the drum locks and core poisons are not removed in the VAB, a drum- 
runout accident is not likely. Handling during the mating of the RIFT stage to the 
S-ll stage appears to be the only area in which an accident could occur. Although 
the possibility of such an incident seems extremely remote, the core compaction re- 
sulting from dropping the stage from an engine gimbal height of approximately 275 
feet must be analyzed to determine the credibility of a nuclear incident. 


Transport from VAB to Launch Pad 

The distance from the VAB to the launch pad of 3-1/2 to 4-1/2 miles (depending 
on which pad is used) is traversed by the crawler at a maximum speed of 1 mile per 
hour. It can move at this speed against a steady wind of 40 knots. Winds greater 
than 99-percent probability during the strongest wind month (54-knot peak winds at 
400 feet) necessitate immediate stoppage of the operation. A forecast of hurricane 
conditions would necessitate transfer back to the VAB, which is designed for hurri- 
cane protection. The crawler maintains the entire launcher platform level with ±10 
minutes of arc over the entire distance, including the 300-foot transition curve to 
the pad. 

During the operation, the only hazard apparent is the abundance of water on 
either side of the 150-foot crawlerway. It would be possible for the nuclear stage 
to be immersed in shallow water if the entire vehicle were tipped or blown over dur- 
ing the transit phase of the pad. If the poison system devised for the reactor core 
is found to be sufficient to prevent an excursion even in the event of water immer- 
sion, then this ceases to be a problem for consideration. The nuclear consequence 
of tipping the entire vehicle over into shallow water with the reactor partially 
poisoned and the control drums locked requires detailed analysis. If it is found 
that an excursion could result, the magnitude of such an accident would then have 
to be weighed against the probability of such an accident ever occurring and the 
costs of land filling 300 feet on both sides of the crawlerway. When the equipment 
to be used in this operation and the experience that will have been amassed in 
several years of SATURN V operations are considered, the possibility of such an 
accident seems extremely remote. 
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Launch-Pad Operations 

Overall operations at the pad before launch are expected to take approximately 
2 weeks. Upon arrival at the pad, all LUT and vehicle service interconnects between 
the launch facility and LCC will be made. They include all digital data links, com- 
munications, pneumatic and propellant supply lines, environmental controls, and power 
distribution cables. All electrical interfaces are made at the launch facility dis- 
tributor located at the pad terminal connection room. After all connections are 
made, overall vertical alignment of the vehicle is accomplished. The crawler then 
moves over to the arming tower (parked 7000 feet away from the pad) and moves it into 
position around the vehicle, thus providing 360 degrees of access to the vehicle for 
ordnance installation and special servicing requirements. 

Installation of all ordnance that could not be installed in the VAB because of 
safety considerations is performed concurrently with other pad operations. (Note 
that although ordnance is installed, it is not armed until the day of launch.) 

The overall launch-pad program, including the simulated flight test, is con- 
ducted preparatory to the launch countdown. 

The simulated flight test will include a complete launch-day simulation. Com- 
patibility with the range is verified at this time. This test is conducted through 
the high-speed data link between the LCC and LUT, the same link used in the VAB . simu- 
lated flight tests. The hardwire system uses battery-powered independent circuitry 
as a backup link between the LCC and pad for safing and monitoring of the launch 
vehicle at the pad in the event of data-link failure. Critical reactor and engine 
control circuits for the RIFT stage will be monitored through this system. Up to 
this time, all of the pad operations discussed have been performed with the reactor 
control drums still mechanically locked and the reactor core poison in position. 

Upon completion of a successful overall simulated flight, the vehicle is ready 
to enter the 10-hour countdown phase of the launch operation. 

Up to launch day, the overall launch-pad checkout should not provide any 
greater degree of hazard from the nuclear state than that present during the VAB 
high-bay checkout because the drum locks and core poisons are still in place. The 
safety of the overall system is somewhat degraded as the countdown progresses by the 
connection of ordnance initiators and arming of the reactor destruct system. Removal 
of core poisons (if required) and removal of manual control-drum locks degrades the 
engine /react or system safety to the level existing during the performance of criti- 
cality checks in the NAB. Propellant loading further degrades the system safety 
from an explosive hazard standpoint. All of the accidents previously postulated 
could occur at the launch pad including possible impact of the reactor in shallow 
water as a result of an early flight failure. Thus, the nuclear hazards associated 
with the following conditions must ultimately be analyzed in detail: 

Gross control-drum runout during the latter phases of count- 
down (after removal of poison and manual locks) . 

Immersion of the reactor in liquid hydrogen or RP-1 as a result 
of an explosion rupturing propellant tanks. (Injection of liquid 
hydrogen into the core through an engine valve failure or leak is 
precluded because of the prevalve used.) 

Implosion of the reactor core as the result of an explosion 
on the pad. 

Impact of the nuclear stage in shallow water as the result of 
an early flight failure. 

As indicated, the time period during which these accidents could occur in the 
launch-pad area is quite small (approximately from T-5 hours up to launch time and 
immediately thereafter). To provide for these possible accidents, the following 
personnel, equipment, and procedures will be available for support in the launch-pad 
area : 
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An extensive launch- comp lex radiation detection and warning 
system. 

Salvage vehicles and equipment. 

Trained salvage crews for cleanup operations (protective 
clothing, portable radiation-detection devices, etc.) will be 
available . 

Methods, equipment, and facilities for disposal of radio- 
active waste material. 

Emergency plan for predicting affected areas. 

Plans, based on detailed environmental surveys, for control 
of on- and off-site areas. 

The equipment and planning will be based on the philosophy that even though 
the postulated accidents are not likely to occur, all credible eventualities must be 
provided for. 


Flight 


The most hazardous phase of any rocket operation, and particularly one contain- 
ing any kind of a nuclear device, is the period immediately following ignition and 
continuing into the early flight phase. In conjunction with the vehicle destruct 
system, the reactor destruct system previously described can be actuated by the range 
safety officer as soon as a vehicle deviates from its planned trajectory. The in- 
corporation of a reactor poison system capable of in-flight actuation would provide 
further backup to the reactor destruct system. 

Impact of the reactor off-shore does not constitute any more of an immediate 
hazard to personnel than an accident in the vicinity of the launch pad. Such an im- 
pact may, however, require continuing surveillance to protect the populace from con- 
taminated marine life or from radioactive material carried by ocean tides and 
currents . 

Downrange activity during a typical RIFT flight will be supported by stations 
in the Bahama Island chain (Grand Bahama, San Salvador, and Grand Turk Islands), 
instrumented ships, and aircraft. The ships will be on station 5 hours and the air- 
craft 1 hour before launch to cover re-entry and impact. Additional ships and in- 
strumented aircraft will be required for the RIFT flights to monitor the fate of 
airborne and seaborne fission products released by the postoperational destruct of 
the NERVA engine. The same airborne and surface craft requirements exist to moni- 
tor and record radioactivity in case of the impact of an expended NERVA engine into 
deep water. 


Conclusions 


The RIFT vehicle, typical RIFT trajectories, prelaunch, launch and flight 
operations and their related safety considerations, based on current planning, have 
been described. It should be emphasized that the launch of the RIFT vehicle is 
several years away and the potential hazards of the operation have been subjected 
to only preliminary study. 

The evaluation of the safety of RIFT operations is and will continue to be of 
prime importance as NERVA and RIFT designs mature and as test data evolve. Much 
work has been done in support of the RIFT flight -safety program, and these efforts 
are being intensified to ensure satisfactory solution of the related safety problems 
before flight testing begins. 
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Current data and analyses lead to the conclusion that the probability of a 
nuclear incident of any kind as a result of planned RIFT operations at Cape Canaveral 
is remote and that the dangers involved should such an incident occur are acceptably 
low. 
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